Feature: Support multiple OOTB workflow sources

[jwforres]

Summary

Currently, out-of-the-box (OOTB) workflows are sourced from a single Git repository configured via the OOTB_WORKFLOWS_REPO environment variable. This limits organizations that want to curate workflows from multiple teams, repos, or registries.

This feature request proposes allowing OOTB workflows to be discovered from multiple Git repositories, with all sources merged into a single list in the UI.

Motivation

• Teams may maintain domain-specific workflow repos (e.g., security workflows in one repo, data engineering workflows in another)
• Organizations may want to layer their own custom OOTB workflows on top of the default ambient-code/workflows repo
• Partners or community sources could be added alongside official workflows

Suggested Implementation

1. Configuration — env var accepts multiple sources

Introduce a new OOTB_WORKFLOWS_SOURCES env var that accepts a JSON array, while keeping the existing single-repo env vars as a backward-compatible fallback:

OOTB_WORKFLOWS_SOURCES='[
  {"repo": "https://github.com/ambient-code/workflows.git", "branch": "main", "path": "workflows"},
  {"repo": "https://github.com/my-org/internal-workflows.git", "branch": "main", "path": "workflows"}
]'

Fallback behavior: If OOTB_WORKFLOWS_SOURCES is not set, fall back to the existing OOTB_WORKFLOWS_REPO / OOTB_WORKFLOWS_BRANCH / OOTB_WORKFLOWS_PATH env vars so existing deployments continue to work without changes.

2. Backend changes (components/backend/handlers/sessions.go)

Cache struct — change ootbWorkflowsCache to cache the merged result keyed on a hash of all source configs:

type ootbWorkflowsCache struct {
    mu        sync.RWMutex
    workflows []OOTBWorkflow
    cachedAt  time.Time
    cacheKey  string // hash of all source configs
}

Handler — update ListOOTBWorkflows() to:

1. Parse the configured sources (new JSON var or legacy single-repo vars)
2. Loop over each source, calling the existing fetchGitHubDirectoryListing / fetchGitHubFileContent helpers
3. Merge results into a single []OOTBWorkflow slice
4. On partial failure (one source errors), still return workflows from successful sources and log a warning

The OOTBWorkflow struct already carries gitUrl, branch, and path per workflow, so no changes are needed there — each workflow is already self-describing.

3. Manifest / config changes

• Update components/manifests/base/core/backend-deployment.yaml to include the new env var
• Update components/manifests/env.example with an example

Considerations

• GitHub API rate limits: More sources = more API calls per cache refresh. The existing 5-minute cache TTL and token-based auth mitigate this, but worth monitoring. Could also fetch sources in parallel with a sync.WaitGroup.
• ID collisions: If two repos have a workflow directory with the same name, the IDs will collide. Prefix workflow IDs with a source identifier (e.g., derived from the repo name) to guarantee uniqueness across sources.
• Partial failure UX: If one source is unreachable, the UI should still show workflows from healthy sources rather than failing entirely.

Files involved

File	Change
components/backend/handlers/sessions.go	Parse multi-source config, loop + merge in handler, update cache key
components/manifests/base/core/backend-deployment.yaml	Add OOTB_WORKFLOWS_SOURCES env var
components/manifests/env.example	Document new env var format

[jeremyeder]

We have a big design for this coming